CVE-2026-16974 in Kirki Plugin
Summary
by MITRE • 08/11/2026
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The Kirki plugin represents a widely used WordPress customization framework that enables users to create sophisticated website builders and customizer interfaces. This particular vulnerability affects versions 6.2.0 and earlier, creating a significant security risk within WordPress environments where the plugin is installed. The issue stems from inadequate input validation mechanisms within the post_meta shortcode functionality, which fails to properly sanitize user-provided data before processing. The vulnerability specifically targets the plugin's handling of metadata inputs that are subsequently rendered in web pages, creating a persistent XSS vector that can be exploited by malicious actors with relatively low privileges.
The technical flaw manifests through insufficient output escaping practices within the plugin's shortcode implementation. When administrators or contributors input data containing malicious script code into post meta fields, this content bypasses proper sanitization filters and gets stored directly within the WordPress database. The vulnerability operates at the point where user-supplied metadata is processed through the post_meta shortcode, which then renders this data without adequate HTML escaping or context-appropriate encoding. This allows attackers to inject JavaScript payloads that execute in the browser context of any user who views pages containing the maliciously injected content, regardless of their privilege level or authentication status.
The operational impact of this vulnerability extends beyond simple script execution, as it provides attackers with persistent access to compromised WordPress installations. Authenticated users with contributor-level permissions or higher can leverage this weakness to inject malicious code that remains active until manually removed from the database. The stored nature of this vulnerability means that once exploited, the malicious scripts continue to execute whenever affected pages are accessed, potentially allowing for session hijacking, data exfiltration, or further exploitation of the compromised environment. This creates a persistent backdoor within the WordPress installation that can be used to compromise multiple users over time.
Security mitigations for this vulnerability should begin with immediate plugin updates to versions 6.2.1 or later where the sanitization issues have been addressed. Organizations should implement comprehensive input validation measures that enforce strict content filtering for all user-supplied metadata fields, particularly those processed through shortcode mechanisms. The implementation of proper output escaping and context-aware encoding practices aligns with established security standards such as CWE-79, which specifically addresses cross-site scripting vulnerabilities through inadequate input sanitization. Additionally, organizations should consider implementing web application firewalls that can detect and block suspicious script injection attempts, while maintaining regular monitoring of database content for unauthorized modifications. The vulnerability also relates to ATT&CK technique T1546.001, which covers changes to Windows Registry or system configuration files, as the stored nature of the XSS payload creates persistent modifications to the WordPress environment that can be leveraged for ongoing compromise.
Organizations using this plugin should conduct thorough security audits of their WordPress installations to identify any existing malicious payloads that may have been injected through this vulnerability. The remediation process must include not only updating the vulnerable plugin but also reviewing all content that was created or modified by users with contributor-level access or higher during the period when the vulnerability was present. Regular security assessments should be implemented to monitor for similar issues in other WordPress plugins and themes, as the underlying architectural weakness demonstrates a common pattern of insufficient input validation that affects many third-party WordPress components. This vulnerability highlights the critical importance of proper data sanitization practices in web applications and serves as a reminder of the potential consequences when basic security controls are omitted from plugin development processes.